@luckystack/test-runner 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,14 @@
+# Changelog
+
+All notable changes to `@luckystack/test-runner` are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0]
+
+### Added
+
+- Initial public release as part of the LuckyStack package split.

package/CLAUDE.md

@@ -0,0 +1,98 @@
+# @luckystack/test-runner
+
+> AI summary + function INDEX. For deep specs see `docs/` next to this file.
+
+## What this package does
+
+Generated-type-driven test layers voor LuckyStack APIs. Walkt elke endpoint uit de generated `apiMethodMap` en draait vijf progressive layers: contract smoke (Zod-valid input), auth enforcement, rate-limit, crash-resistance fuzz, en per-route custom tests (`<name>_v<N>.tests.ts` naast `_api/`/`_sync/` sources). Elke layer is independent runnable; `runAllTests` orchestreert alles in volgorde en levert een geaggregeerde summary op. Reporter/fixture/layer-extension registries laten consumers eigen checks plug-in zonder de framework te forken.
+
+## When to USE this package
+
+- Je wil elke `_api/*` route automatisch valideren tegen de generated contract zonder per endpoint een testfile te schrijven.
+- Je wil in CI verifiëren dat endpoints met `auth.login: true` daadwerkelijk 401 returneren voor unauthenticated requests.
+- Je wil rate-limit gedrag (`rateLimit: N`) confirmeren zonder handmatig de `N+1`th request te bouwen.
+- Je wil nightly crash-resistance fuzz draaien op alle endpoints om 500-stacks te vangen.
+- Je wil custom test-layers, fixtures of een webhook reporter toevoegen aan de standard sweep.
+
+## When to NOT suggest this (yet)
+
+- Voor unit tests van pure functions binnen `_api/*` — gebruik vitest/jest direct, niet deze runner.
+- Voor frontend-UI tests — gebruik Playwright/`webapp-testing` skill, deze runner is server-only.
+- Wanneer er geen generated `apiMethodMap` beschikbaar is (project gebruikt geen `@luckystack/devkit`).
+- Wanneer de target server productie is — fuzz/rate-limit layers maken honderden requests en `/_test/reset` is daar uit.
+- Voor sync-event testing via de auto-sweep — die walkt momenteel alleen API endpoints, niet de sync map (sync support voor de auto-layers staat op de roadmap maar is nog niet geleverd). Layer 5 (`runCustomTests` / `<name>_v<N>.tests.ts`) ondersteunt al wél sync routes via per-route testfiles naast `_sync/` sources.
+
+## Function Index
+
+| Function / Export | 1-regel | Deep doc |
+|---|---|---|
+| `runAllTests({ apiMethodMap, apiMetaMap, apiInputSchemas, baseUrl, ... })` | Orchestrator: draait contract + auth + rate-limit + fuzz + custom (Layer 5) in volgorde, levert een `RunAllTestsSummary`. | → docs/contract-tests.md |
+| `runCustomTests(input)` | Layer 5: draait per-route `<name>_v<N>.tests.ts` files naast de `_api/` / `_sync/` sources, levert een `RunCustomTestsSummary`. | → docs/contract-tests.md |
+| `discoverCustomTestFiles(srcDir?)` | Walker die elke `<name>_v<N>.tests.ts` onder de configured src dir yields. | → docs/contract-tests.md |
+| `logRunAllSummary(summary)` | Pretty-print één `RunAllTestsSummary`. | → docs/extension-hooks.md |
+| `walkEndpoints(apiMethodMap)` | Genereert `EndpointDescriptor[]` uit de generated map | → docs/contract-tests.md |
+| `runContractCheck({ endpoint, baseUrl, inputFor?, headers? })` | Single-endpoint contract smoke | → docs/contract-tests.md |
+| `runContractTests({ apiMethodMap, baseUrl, skip?, inputFor?, headers?, onResult? })` | Full sweep contract layer | → docs/contract-tests.md |
+| `runAuthEnforcementCheck({ endpoint, baseUrl, inputFor? })` | Single-endpoint auth check (verwacht 401 zonder token) | → docs/auth-tests.md |
+| `runAuthEnforcementTests({ apiMethodMap, apiMetaMap, baseUrl, skip?, inputFor?, onResult? })` | Sweep alle `auth.login: true` endpoints | → docs/auth-tests.md |
+| `runRateLimitCheck({ endpoint, baseUrl, rateLimit, inputFor?, headers? })` | Single-endpoint rate-limit assertie | → docs/rate-limit-tests.md |
+| `runRateLimitTests({ apiMethodMap, apiMetaMap, baseUrl, skip?, inputFor?, headers?, maxRateLimitToTest?, resetBetweenEndpoints?, resetToken?, onResult? })` | Sweep alle `rateLimit: N` endpoints | → docs/rate-limit-tests.md |
+| `runFuzzCheck({ endpoint, baseUrl, headers? })` | Single-endpoint crash-resistance fuzz | → docs/fuzz-tests.md |
+| `runFuzzTests({ apiMethodMap, baseUrl, skip?, headers?, onResult? })` | Sweep fuzz layer (nightly CI) | → docs/fuzz-tests.md |
+| `resetServerState({ baseUrl, token? })` | POST naar `/_test/reset` om DB+Redis schoon te maken | → docs/rate-limit-tests.md |
+| `sampleSchemaInput(schema)` | Genereert Zod-valid sample payload uit een schema | → docs/contract-tests.md |
+| `logContractResult(result)` | Pretty-print één `ContractCheckResult` | → docs/extension-hooks.md |
+| `logContractSummary(summary)` | Pretty-print aggregate `RunContractSummary` | → docs/extension-hooks.md |
+| `registerTestLayer(layer)` | Plug-in custom test-layer (CORS, business rules, multi-tenant) | → docs/extension-hooks.md |
+| `listTestLayers()` | Lees alle geregistreerde custom layers | → docs/extension-hooks.md |
+| `registerTestFixture(typeKey, fixture)` | Realistic-payload fixtures per typeKey (valid + invalid) | → docs/fuzz-tests.md |
+| `getTestFixture(typeKey)` | Lees fixture voor een typeKey | → docs/fuzz-tests.md |
+| `registerTestReporter(reporter)` | Plug-in onResult/onSummary/webhookUrl callbacks | → docs/extension-hooks.md |
+| `getTestReporter()` | Lees actieve reporter callbacks | → docs/extension-hooks.md |
+| `resetTestExtensionsForTests()` | Clear alle registries (alleen voor interne tests) | → docs/extension-hooks.md |
+| Type: `EndpointDescriptor` | `{ page, name, version, method, fullPath }` | → docs/contract-tests.md |
+| Type: `HttpMethod` | `'GET' \| 'POST' \| 'PUT' \| 'DELETE'` | → docs/contract-tests.md |
+| Type: `ContractCheckResult` | Single-result shape (status, httpStatus, responseStatus, errorCode, reason, durationMs) | → docs/contract-tests.md |
+| Type: `RunContractSummary` | Aggregate shape (total, passed, failed, skipped, results[]) | → docs/contract-tests.md |
+| Type: `TestLayer` / `TestLayerInput` / `TestLayerResult` | Custom-layer interface | → docs/extension-hooks.md |
+| Type: `TestFixture` | `{ valid: T[], invalid: T[] }` per typeKey | → docs/fuzz-tests.md |
+| Type: `TestResult` / `TestSummary` | Aggregate shapes voor extension registry | → docs/extension-hooks.md |
+| Type: `TestReporter` | `{ onResult?, onSummary?, webhookUrl?, webhookAuth? }` | → docs/extension-hooks.md |
+| Type: `RunContractTestsInput` / `ContractCheckInput` | Inputs voor contract layer | → docs/contract-tests.md |
+| Type: `RunAuthEnforcementTestsInput` / `AuthEnforcementCheckInput` | Inputs voor auth layer | → docs/auth-tests.md |
+| Type: `RunRateLimitTestsInput` / `RateLimitCheckInput` | Inputs voor rate-limit layer | → docs/rate-limit-tests.md |
+| Type: `RunFuzzTestsInput` / `FuzzCheckInput` | Inputs voor fuzz layer | → docs/fuzz-tests.md |
+| Type: `ResetServerStateInput` | Input voor `resetServerState` | → docs/rate-limit-tests.md |
+| Type: `TestContext` | `{ callApi, callSync, watchStream, session, prisma, expect }` — handed naar elke Layer-5 custom-tests case. | → docs/contract-tests.md |
+| `ctx.watchStream(roomCode)` | Open een second-socket (socket B) joined aan `roomCode` om de chunk stream van `broadcastStream`/`streamTo`/`_client_v{N}` te observeren. Returnt `StreamWatcher<TChunk>` met `.chunks[]`, `.stopAt(predicate, timeoutMs?)`, `.waitForCount(n, timeoutMs?)`, `.close()`. Watchers worden auto-closed na elke case. | → docs/contract-tests.md |
+| `openStreamWatcher(input)` | Lower-level factory voor `watchStream` — direct bruikbaar buiten een `TestContext` (custom layers, ad-hoc harness scripts). | → docs/contract-tests.md |
+| Type: `StreamWatcher<TChunk>` | `{ readonly chunks, stopAt, waitForCount, close }` — observable chunk stream voor één route. | → docs/contract-tests.md |
+| Type: `StreamChunkFrame` | Wire-shape van een sync chunk frame (`{ cb, fullName, status: 'stream', ...payload }`). Default chunk type voor `StreamWatcher`. | → docs/contract-tests.md |
+| Type: `OpenStreamWatcherInput` | `{ baseUrl, roomCode, token, routeFullName, defaultTimeoutMs? }` voor `openStreamWatcher`. | → docs/contract-tests.md |
+| Type: `CustomTestCase` | `{ name, run(ctx) }` — shape die consumers exporteren uit `<name>_v<N>.tests.ts`. | → docs/contract-tests.md |
+| Type: `RunAllTestsSummary` | Aggregate result shape voor `runAllTests` (per-layer summaries + totals). | → docs/contract-tests.md |
+| Type: `RunCustomTestsSummary` | Aggregate result shape voor `runCustomTests` (per-file resultaten + totals). | → docs/contract-tests.md |
+
+## Config keys (env vars + register* slots)
+
+- `NODE_ENV` (env, server-side) — `/_test/reset` is automatisch beschikbaar wanneer NIET `production`.
+- `TEST_RESET_TOKEN` (env, optional, server-side) — wanneer gezet moet `resetServerState({ token })` deze meesturen als `X-Test-Reset-Token`. Verplicht voor staging/preview deploys die het endpoint over het netwerk exposen.
+- `RunRateLimitTestsInput.maxRateLimitToTest` (default `50`) — endpoints met hogere `rateLimit` worden geskipt om duizenden requests in CI te vermijden.
+- `RunRateLimitTestsInput.resetBetweenEndpoints` (default `false`) — hit `/_test/reset` voor elke endpoint zodat het shared IP-bucket schoon is.
+- `registerTestLayer({ name, run })` — custom check per endpoint (CORS, business rules, custom auth-schemes, multi-tenant isolation).
+- `registerTestFixture(typeKey, { valid, invalid })` — realistic payloads die de fuzz layer prefereert boven schema-random.
+- `registerTestReporter({ onResult?, onSummary?, webhookUrl?, webhookAuth? })` — wire per-result/per-summary callbacks of POST de summary naar een webhook.
+
+## Peer dependencies
+
+- **Required**: `zod@^4.0.0` (peer), `socket.io-client@^4.8.0` (peer — `streamWatcher.ts` opent een tweede socket voor `ctx.watchStream`), `@luckystack/core@^0.1.0` (dependency — leest `getApiMethodMapPath()` voor de default map-locatie).
+- **Required server-side**: `@luckystack/server` met `/_test/reset` endpoint gemount (default ingebouwd, gated op `NODE_ENV !== 'production'`).
+- **Required generated artefact**: `apiMethodMap.generated.ts` (en `apiMetaMap.generated.ts` voor de auth/rate-limit layers), geproduceerd door `@luckystack/devkit`.
+- **Optional**: geen — fixtures, reporters en custom layers zijn pure-JS opt-in.
+
+## Related
+
+- Architecture deep-dives: `/docs/ARCHITECTURE_API.md` (het contract dat deze runner asserteert), `/docs/ARCHITECTURE_PACKAGING.md` (hoe generated maps per preset worden geëmit).
+- Consumer quickstart: `./README.md`.
+- Devkit (genereert de maps die deze runner consumeert): `packages/devkit/CLAUDE.md`.
+- Server (`/_test/reset` endpoint): `packages/server/CLAUDE.md`.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Mathijs van Melick
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,83 @@
+# @luckystack/test-runner
+
+> Generated-type-driven test layers for [LuckyStack](https://github.com/ItsLucky23/LuckyStack-v2). Walks every endpoint in your `apiMethodMap.generated.ts` and runs four progressive test layers: contract smoke (Zod-valid input), auth enforcement, rate-limit, and crash-resistance fuzz.
+
+## Install
+
+```bash
+npm install --save-dev @luckystack/test-runner zod
+```
+
+## Quickstart
+
+Run all four layers against a running server:
+
+```ts
+import {
+  runContractTests,
+  runAuthEnforcementTests,
+  runRateLimitTests,
+  runFuzzTests,
+  resetServerState,
+  logContractSummary,
+} from '@luckystack/test-runner';
+import { apiMethodMap } from './src/_sockets/apiMethodMap.generated';
+import { apiMetaMap } from './src/_sockets/apiMetaMap.generated';
+
+const baseUrl = process.env.TEST_BASE_URL ?? 'http://127.0.0.1:80';
+const contract = await runContractTests({ apiMethodMap, baseUrl });
+logContractSummary(contract);
+
+const auth = await runAuthEnforcementTests({ apiMethodMap, apiMetaMap, baseUrl });
+const rate = await runRateLimitTests({ apiMethodMap, apiMetaMap, baseUrl });
+const fuzz = await runFuzzTests({ apiMethodMap, baseUrl });
+
+await resetServerState({ baseUrl });
+```
+
+Each layer is independently runnable — you can skip the ones that don't apply or rearrange them.
+
+## Layers
+
+| Layer | What it asserts |
+| --- | --- |
+| **Contract** | A Zod-valid input payload reaches `main` and returns `{ status: 'success' }` (or a typed failure status). Catches schema/route mismatches. |
+| **Auth enforcement** | Endpoints flagged `auth.login: true` reject unauthenticated requests with the framework's standard 401 shape. |
+| **Rate limit** | Endpoints with `rateLimit: <N>` reject the `(N + 1)`th request inside the window. |
+| **Fuzz** | Bad/random inputs never crash the server (still returns a typed error response, never 500 with a stack). |
+
+The fuzz layer is intentionally exhaustive and slow — wire it into nightly CI rather than every PR.
+
+## Server hooks it depends on
+
+- `/_test/reset` endpoint — served by `@luckystack/server` outside production (gated on `NODE_ENV !== 'production'` and an optional `TEST_RESET_TOKEN`). Used by `resetServerState` to clear DB + Redis between layers. Make sure `TEST_RESET_TOKEN` is set in any non-prod environment that is reachable over the network.
+- `apiMethodMap.generated.ts` — produced by `@luckystack/devkit` from your `_api/*` files. Defaults are read via `getApiMethodMapPath()` from `@luckystack/core`.
+
+## Public API
+
+| Export | Purpose |
+| --- | --- |
+| `walkEndpoints(apiMethodMap)` | Returns `EndpointDescriptor[]` from the generated map. |
+| `runContractCheck(input)` / `runContractTests(input)` | Single endpoint / full sweep. |
+| `runAuthEnforcementCheck(input)` / `runAuthEnforcementTests(input)` | Auth layer. |
+| `runRateLimitCheck(input)` / `runRateLimitTests(input)` | Rate-limit layer. |
+| `runFuzzCheck(input)` / `runFuzzTests(input)` | Fuzz layer. |
+| `resetServerState(input)` | POST to `/_test/reset`. |
+| `sampleSchemaInput(schema)` | Generate a Zod-valid sample payload. |
+| `logContractResult` / `logContractSummary` | Pretty-printers. |
+
+Types: `EndpointDescriptor`, `HttpMethod`, `ContractCheckResult`, `RunContractSummary`, plus per-layer input types.
+
+## Related architecture docs
+
+- [`docs/ARCHITECTURE_API.md`](../../docs/ARCHITECTURE_API.md) — the contract this runner asserts against.
+- [`docs/ARCHITECTURE_PACKAGING.md`](../../docs/ARCHITECTURE_PACKAGING.md) — how generated maps are emitted per preset.
+
+## Dependencies
+
+- Peer (canonical ranges, standardized 2026-05-07):
+  - `zod@^3.25.0`
+
+## License
+
+MIT — see [LICENSE](../../LICENSE).

package/dist/index.d.ts

@@ -0,0 +1,433 @@
+import { z, ZodType } from 'zod';
+import { getPrismaClient } from '@luckystack/core';
+
+type HttpMethod = 'GET' | 'POST' | 'PUT' | 'DELETE';
+interface EndpointDescriptor {
+    page: string;
+    name: string;
+    version: string;
+    method: HttpMethod;
+    /** `api/<page>/<name>/<version>` */
+    fullPath: string;
+}
+interface ContractCheckResult {
+    endpoint: EndpointDescriptor;
+    status: 'pass' | 'fail' | 'skipped';
+    httpStatus?: number;
+    responseStatus?: 'success' | 'error' | 'unknown';
+    errorCode?: string;
+    reason?: string;
+    durationMs: number;
+}
+interface RunContractSummary {
+    total: number;
+    passed: number;
+    failed: number;
+    skipped: number;
+    results: ContractCheckResult[];
+}
+
+type ApiMethodMap$6 = Partial<Record<string, Partial<Record<string, Partial<Record<string, string>>>>>>;
+declare const walkEndpoints: (apiMethodMap: ApiMethodMap$6) => EndpointDescriptor[];
+
+interface ContractCheckInput {
+    endpoint: EndpointDescriptor;
+    baseUrl: string;
+    /**
+     * Optional input factory. Defaults to `{}`. When an endpoint requires a
+     * specific shape to not crash, callers can override per-endpoint here.
+     */
+    inputFor?: (endpoint: EndpointDescriptor) => unknown;
+    /**
+     * Optional headers (auth tokens, cookies). Applied to every request.
+     */
+    headers?: Record<string, string>;
+    /**
+     * Per-call request timeout in ms. Defaults to 5000. Bump for slow endpoints
+     * (AI calls, large reports) where the framework default would false-fail
+     * the contract check.
+     */
+    requestTimeoutMs?: number;
+}
+declare const runContractCheck: (input: ContractCheckInput) => Promise<ContractCheckResult>;
+
+type ApiMethodMap$5 = Partial<Record<string, Partial<Record<string, Partial<Record<string, string>>>>>>;
+interface RunContractTestsInput {
+    apiMethodMap: ApiMethodMap$5;
+    baseUrl: string;
+    /**
+     * Endpoints to skip. Matched against `<page>/<name>` (version-agnostic) and
+     * `<page>/<name>/<version>` (version-specific). Useful for endpoints that
+     * are known to need real input (e.g. a file upload).
+     */
+    skip?: string[];
+    inputFor?: (endpoint: EndpointDescriptor) => unknown;
+    headers?: Record<string, string>;
+    onResult?: (result: ContractCheckResult) => void;
+}
+declare const runContractTests: (input: RunContractTestsInput) => Promise<RunContractSummary>;
+
+interface AuthEnforcementCheckInput {
+    endpoint: EndpointDescriptor;
+    baseUrl: string;
+    inputFor?: (endpoint: EndpointDescriptor) => unknown;
+    /** Per-call request timeout in ms. Defaults to 5000. */
+    requestTimeoutMs?: number;
+}
+declare const runAuthEnforcementCheck: (input: AuthEnforcementCheckInput) => Promise<ContractCheckResult>;
+
+type ApiMethodMap$4 = Partial<Record<string, Partial<Record<string, Partial<Record<string, string>>>>>>;
+type ApiMetaMap$2 = Partial<Record<string, Partial<Record<string, Partial<Record<string, {
+    method: string;
+    auth: {
+        login: boolean;
+        additional?: Record<string, unknown>[];
+    };
+    rateLimit?: number | false;
+}>>>>>>;
+interface RunAuthEnforcementTestsInput {
+    apiMethodMap: ApiMethodMap$4;
+    apiMetaMap: ApiMetaMap$2;
+    baseUrl: string;
+    skip?: string[];
+    inputFor?: (endpoint: EndpointDescriptor) => unknown;
+    onResult?: (result: ContractCheckResult) => void;
+}
+declare const runAuthEnforcementTests: (input: RunAuthEnforcementTestsInput) => Promise<RunContractSummary>;
+
+interface RateLimitCheckInput {
+    endpoint: EndpointDescriptor;
+    baseUrl: string;
+    rateLimit: number;
+    inputFor?: (endpoint: EndpointDescriptor) => unknown;
+    headers?: Record<string, string>;
+    /** Per-call request timeout in ms. Defaults to 10000. */
+    requestTimeoutMs?: number;
+}
+declare const runRateLimitCheck: (input: RateLimitCheckInput) => Promise<ContractCheckResult>;
+
+type ApiMethodMap$3 = Partial<Record<string, Partial<Record<string, Partial<Record<string, string>>>>>>;
+type ApiMetaMap$1 = Partial<Record<string, Partial<Record<string, Partial<Record<string, {
+    method: string;
+    auth: {
+        login: boolean;
+        additional?: Record<string, unknown>[];
+    };
+    rateLimit?: number | false;
+}>>>>>>;
+interface RunRateLimitTestsInput {
+    apiMethodMap: ApiMethodMap$3;
+    apiMetaMap: ApiMetaMap$1;
+    baseUrl: string;
+    skip?: string[];
+    inputFor?: (endpoint: EndpointDescriptor) => unknown;
+    headers?: Record<string, string>;
+    /**
+     * Max rateLimit value to test. Endpoints with a higher limit are skipped
+     * to avoid firing thousands of requests in CI.
+     */
+    maxRateLimitToTest?: number;
+    /**
+     * When true, hit `/_test/reset` before each endpoint so limiter state is
+     * clean. Requires the server to allow the endpoint (NODE_ENV !== production
+     * or `TEST_RESET_TOKEN` configured). Without resetting, the shared IP bucket
+     * leaks state between endpoints.
+     */
+    resetBetweenEndpoints?: boolean;
+    /**
+     * Token forwarded as `X-Test-Reset-Token` when resetting. Only relevant in
+     * staging/preview deploys that enable the endpoint behind a token.
+     */
+    resetToken?: string;
+    onResult?: (result: ContractCheckResult) => void;
+}
+declare const runRateLimitTests: (input: RunRateLimitTestsInput) => Promise<RunContractSummary>;
+
+interface FuzzCheckInput {
+    endpoint: EndpointDescriptor;
+    baseUrl: string;
+    headers?: Record<string, string>;
+    /** Per-call request timeout in ms. Defaults to 5000. */
+    requestTimeoutMs?: number;
+}
+declare const runFuzzCheck: (input: FuzzCheckInput) => Promise<ContractCheckResult>;
+
+type ApiMethodMap$2 = Partial<Record<string, Partial<Record<string, Partial<Record<string, string>>>>>>;
+interface RunFuzzTestsInput {
+    apiMethodMap: ApiMethodMap$2;
+    baseUrl: string;
+    skip?: string[];
+    headers?: Record<string, string>;
+    onResult?: (result: ContractCheckResult) => void;
+}
+declare const runFuzzTests: (input: RunFuzzTestsInput) => Promise<RunContractSummary>;
+
+interface ResetServerStateInput {
+    baseUrl: string;
+    token?: string;
+}
+declare const resetServerState: ({ baseUrl, token }: ResetServerStateInput) => Promise<boolean>;
+
+declare const sampleSchemaInput: (schema: z.ZodType) => unknown;
+
+declare const logContractResult: (result: ContractCheckResult) => void;
+declare const logContractSummary: (summary: RunContractSummary) => void;
+
+interface StreamChunkFrame {
+    /** Per-request correlation id stamped by the server. */
+    cb?: string;
+    /** Full route name (`sync/<page>/<name>/<version>`). */
+    fullName?: string;
+    /** Always `'stream'` for chunk frames. */
+    status?: 'stream';
+    /** Payload fields spread on top of the envelope. */
+    [key: string]: unknown;
+}
+interface StreamWatcher<TChunk extends StreamChunkFrame = StreamChunkFrame> {
+    /** Chunks received so far. Array reference is stable; entries are pushed in arrival order. */
+    readonly chunks: TChunk[];
+    /** Wait until `predicate(chunks)` returns true, or until timeout (default 5000ms). */
+    stopAt(predicate: (chunks: TChunk[]) => boolean, timeoutMs?: number): Promise<void>;
+    /** Wait until N total chunks received, or until timeout. */
+    waitForCount(n: number, timeoutMs?: number): Promise<void>;
+    /** Close socket B. Tests SHOULD call this in cleanup; ctx auto-closes all watchers when the test ends. */
+    close(): Promise<void>;
+}
+interface OpenStreamWatcherInput {
+    /** Server URL (same as `ctx`'s `baseUrl`). */
+    baseUrl: string;
+    /** Room to join as a pure subscriber. */
+    roomCode: string;
+    /** Active session token (used for `joinRoom` auth). May be null for routes that don't require auth. */
+    token: string | null;
+    /**
+     * Resolved route name `sync/<page>/<name>/<version>` — chunk frames are
+     * filtered by their `fullName` property so a watcher only surfaces chunks
+     * for the route its test is bound to.
+     */
+    routeFullName: string;
+    /** Default 5000ms — overridable per `stopAt` / `waitForCount` call. */
+    defaultTimeoutMs?: number;
+}
+declare const openStreamWatcher: <TChunk extends StreamChunkFrame = StreamChunkFrame>(input: OpenStreamWatcherInput) => Promise<StreamWatcher<TChunk>>;
+
+type ApiMethodMap$1 = Partial<Record<string, Partial<Record<string, Partial<Record<string, string>>>>>>;
+interface CustomTestCase {
+    name: string;
+    run: (ctx: TestContext) => Promise<void>;
+    /**
+     * Mark this case as a KNOWN, accepted failure (e.g. a documented bug not
+     * yet fixed, or a scenario the current implementation cannot satisfy). The
+     * string is the reason shown in the report. A case marked `expectedToFail`
+     * that throws is reported as `xfail` — counted separately, NOT a red
+     * failure. If it unexpectedly PASSES it is reported as `xpass` so the stale
+     * marker can be removed. Leave undefined for normal cases.
+     */
+    expectedToFail?: string;
+}
+interface CustomTestResult {
+    routePath: string;
+    caseName: string;
+    status: 'pass' | 'fail' | 'xfail' | 'xpass';
+    durationMs: number;
+    reason?: string;
+    /** Documented reason when the case carried an `expectedToFail` marker. */
+    expectedToFail?: string;
+}
+interface RunCustomTestsSummary {
+    total: number;
+    passed: number;
+    failed: number;
+    /** Cases marked `expectedToFail` that failed as expected (known issues). */
+    xfailed: number;
+    /** Cases marked `expectedToFail` that unexpectedly passed (remove the marker). */
+    xpassed: number;
+    results: CustomTestResult[];
+}
+interface RunCustomTestsInput {
+    baseUrl: string;
+    /** Optional cookie name for the session token. Defaults to the project's configured cookie. */
+    sessionCookieName?: string;
+    /** Filter to a subset of routes — substring match against `<page>/<name>/<version>`. */
+    filter?: string;
+    /**
+     * Generated `apiMethodMap` so the harness sends each API route its declared
+     * HTTP method (e.g. logout is DELETE). Falls back to POST when absent.
+     */
+    apiMethodMap?: ApiMethodMap$1;
+    onResult?: (result: CustomTestResult) => void;
+}
+interface DiscoveredTestFile {
+    /** Absolute path to the test file. */
+    filePath: string;
+    /** `api` or `sync` — which transport this route uses. */
+    kind: 'api' | 'sync';
+    /** Route descriptor parsed from the filename + directory location. */
+    route: {
+        page: string;
+        name: string;
+        version: string;
+    };
+}
+declare const discoverCustomTestFiles: (srcDir?: string) => DiscoveredTestFile[];
+interface TestContext {
+    /** Invoke the route under test. Page / name / version are baked in. */
+    callApi: <TInput = unknown, TOutput = unknown>(input: TInput) => Promise<TOutput>;
+    callSync: <TInput = unknown, TOutput = unknown>(input: TInput, opts?: {
+        receiver?: string;
+    }) => Promise<TOutput>;
+    /**
+     * Open a second socket connection that joins `roomCode` as a pure
+     * subscriber and exposes the incoming chunk stream for assertions.
+     *
+     * The route is auto-derived from the test file location, so a watcher
+     * only surfaces chunks for the route this test belongs to. Multiple
+     * watchers per test are allowed; all are auto-closed when the test
+     * case finishes (whether it passes or throws).
+     */
+    watchStream: <TChunk extends StreamChunkFrame = StreamChunkFrame>(roomCode: string) => Promise<StreamWatcher<TChunk>>;
+    session: {
+        login: (user?: {
+            email?: string;
+            id?: string;
+            name?: string;
+        }) => Promise<{
+            token: string;
+            userId: string;
+        }>;
+        logout: () => Promise<void>;
+        current: () => {
+            token: string | null;
+            userId: string | null;
+        };
+    };
+    prisma: ReturnType<typeof getPrismaClient>;
+    expect: TestExpect;
+}
+interface TestExpect {
+    eq: <T>(actual: T, expected: T, message?: string) => void;
+    ok: (value: unknown, message?: string) => void;
+    throws: (fn: () => Promise<unknown>, message?: string) => Promise<Error>;
+    matches: (value: string, pattern: RegExp, message?: string) => void;
+}
+declare const runCustomTests: (input: RunCustomTestsInput) => Promise<RunCustomTestsSummary>;
+
+type ApiMethodMap = Partial<Record<string, Partial<Record<string, Partial<Record<string, string>>>>>>;
+type ApiMetaMap = Partial<Record<string, Partial<Record<string, Partial<Record<string, {
+    method: string;
+    auth: {
+        login: boolean;
+        additional?: Record<string, unknown>[];
+    };
+    rateLimit?: number | false;
+}>>>>>>;
+type ApiInputSchemas = Partial<Record<string, Partial<Record<string, Partial<Record<string, ZodType | undefined>>>>>>;
+interface RunAllTestsInput {
+    apiMethodMap: ApiMethodMap;
+    apiMetaMap: ApiMetaMap;
+    apiInputSchemas: ApiInputSchemas;
+    baseUrl: string;
+    /** Cookie name for the session token. Defaults to `luckystack_token`. */
+    sessionCookieName?: string;
+    /** Auth token applied as a `Cookie` header to sweep-layer requests that need a session. */
+    authToken?: string;
+    /** Endpoints to skip from the sweep layers, e.g. routes that need a file upload. */
+    skip?: string[];
+    /** Substring filter applied to `<page>/<name>/<version>`. */
+    filter?: string;
+    /** Disable individual layers (faster local iteration). */
+    noSweep?: boolean;
+    noFuzz?: boolean;
+    noRateLimit?: boolean;
+    noCustom?: boolean;
+}
+interface RunAllTestsSummary {
+    contract?: RunContractSummary;
+    auth?: RunContractSummary;
+    rateLimit?: RunContractSummary;
+    fuzz?: RunContractSummary;
+    custom?: RunCustomTestsSummary;
+    totalPassed: number;
+    totalFailed: number;
+}
+declare const runAllTests: (input: RunAllTestsInput) => Promise<RunAllTestsSummary>;
+declare const logRunAllSummary: (summary: RunAllTestsSummary) => void;
+
+interface TestLayerInput {
+    /** Resolved route name (`api/billing/getInvoice/v1`). */
+    endpoint: string;
+    /** Method when applicable, undefined for sync endpoints. */
+    method?: string;
+    /** Bearer token / session token to use for auth-aware checks. */
+    authToken?: string;
+}
+interface TestLayerResult {
+    passed: boolean;
+    /** Short reason key — i18n-style errorCode when failed. */
+    message?: string;
+    /** Optional extras for the reporter (latency, response sample, ...). */
+    metadata?: Record<string, unknown>;
+}
+interface TestLayer {
+    name: string;
+    run: (input: TestLayerInput) => Promise<TestLayerResult> | TestLayerResult;
+}
+interface TestFixture<TPayload = unknown> {
+    valid: TPayload[];
+    invalid: TPayload[];
+}
+interface TestResult {
+    layer: string;
+    endpoint: string;
+    passed: boolean;
+    message?: string;
+    durationMs?: number;
+    metadata?: Record<string, unknown>;
+}
+interface TestSummary {
+    totalLayers: number;
+    totalEndpoints: number;
+    passed: number;
+    failed: number;
+    results: TestResult[];
+}
+interface TestReporter {
+    /** Called once per individual TestResult as the runner progresses. */
+    onResult?: (result: TestResult) => void | Promise<void>;
+    /** Called once at the end with the aggregated summary. */
+    onSummary?: (summary: TestSummary) => void | Promise<void>;
+    /** Optional webhook the runner POSTs the summary to. */
+    webhookUrl?: string;
+    webhookAuth?: {
+        type: 'bearer';
+        token: string;
+    };
+}
+/**
+ * Register a custom test layer. Re-registering the same name replaces
+ * the previous entry. Use for CORS enforcement, business-rule checks,
+ * custom auth schemes, multi-tenant isolation, GDPR data-flow checks.
+ */
+declare const registerTestLayer: (layer: TestLayer) => void;
+declare const listTestLayers: () => TestLayer[];
+/**
+ * Register a realistic payload fixture for a specific type key. The fuzz
+ * layer prefers these over schema-random generated inputs when a fixture
+ * exists for the endpoint's input type.
+ *
+ * `valid` payloads are used to verify happy-path behavior; `invalid`
+ * payloads probe the validator's error responses.
+ */
+declare const registerTestFixture: <TPayload = unknown>(typeKey: string, fixture: TestFixture<TPayload>) => void;
+declare const getTestFixture: (typeKey: string) => TestFixture | undefined;
+/**
+ * Register a test reporter. Set `null` to unregister. The runner calls
+ * `onResult` per individual result as the run progresses and `onSummary`
+ * once at the end. When `webhookUrl` is set, the runner additionally
+ * POSTs the JSON-serialised summary to that URL.
+ */
+declare const registerTestReporter: (newReporter: TestReporter | null) => void;
+declare const getTestReporter: () => TestReporter | null;
+declare const resetTestExtensionsForTests: () => void;
+
+export { type AuthEnforcementCheckInput, type ContractCheckInput, type ContractCheckResult, type CustomTestCase, type CustomTestResult, type EndpointDescriptor, type FuzzCheckInput, type HttpMethod, type OpenStreamWatcherInput, type RateLimitCheckInput, type ResetServerStateInput, type RunAllTestsInput, type RunAllTestsSummary, type RunAuthEnforcementTestsInput, type RunContractSummary, type RunContractTestsInput, type RunCustomTestsInput, type RunCustomTestsSummary, type RunFuzzTestsInput, type RunRateLimitTestsInput, type StreamChunkFrame, type StreamWatcher, type TestContext, type TestExpect, type TestFixture, type TestLayer, type TestLayerInput, type TestLayerResult, type TestReporter, type TestResult, type TestSummary, discoverCustomTestFiles, getTestFixture, getTestReporter, listTestLayers, logContractResult, logContractSummary, logRunAllSummary, openStreamWatcher, registerTestFixture, registerTestLayer, registerTestReporter, resetServerState, resetTestExtensionsForTests, runAllTests, runAuthEnforcementCheck, runAuthEnforcementTests, runContractCheck, runContractTests, runCustomTests, runFuzzCheck, runFuzzTests, runRateLimitCheck, runRateLimitTests, sampleSchemaInput, walkEndpoints };